Open Policy Agent (OPA)

Open Policy Agent (OPA) is an open-source, general-purpose policy engine and a CNCF graduated project. It provides a declarative language called Rego that users write to create context-aware policies queried by services through an API. OPA integrates with Kubernetes, Terraform, Envoy, Kafka, and other systems. Conftest, a related project, uses OPA's Rego language to write tests against structured configuration data such as Kubernetes manifests, Terraform code, and Tekton pipeline definitions.

Centralize policy decisions across microservices, admission control, and infrastructure configuration with a decoupled policy engine, and test configurations with Conftest before deployment.

• +General-purpose engine decoupled from the services it protects.
• +Rego expresses context-aware policies over arbitrary structured data supplied with each query.
• +CNCF graduated project with a published ecosystem directory of integrations.

• +Policies are written in Rego, a Datalog-inspired declarative language that differs from general-purpose programming languages.
• +OPA and Rego are domain-agnostic, so security policies must be written or sourced separately.
• +Operational overhead of running OPA as a sidecar or standalone service.

Deploy OPA as an admission controller or sidecar to enforce security rules, and write Conftest tests in CI to catch policy violations in IaC before they reach clusters.